Skip to main content

news

 

Singapore law firm Shook Lin & Bok was hit by a cyberattack in April and the matter is currently under investigation by local authorities.

The incident was discovered on Apr. 9, the firm confirmed. “SLB immediately engaged a cyber security team and our systems were contained as of 0200 hours on Apr. 10, 2024,” it said in a statement.

“There is thus far no evidence that the firm's core document management systems which contain client data were affected.” the statement added.

The Straits Times, citing SuspectFile—a website that tracks cybersecurity incidents—reported that Shook Lin & Bok paid 21.07 bitcoins ($1.4 million) to Akira ransomware group spread across three transactions.

The law firm said it is working closely with cyber security teams and other specialists to do all that it can to minimise impact to its clients and stakeholders.

“The matter has been reported to the relevant authorities as we are obliged to do so under Singapore law. It is now under investigation, and it would therefore be inappropriate to comment on the investigations,” Shook Lin & Bok added.

Authorities investigating the matter include the Cyber Security Agency of Singapore (CSA), and the Personal Data Protection Commission Singapore.

Law firms have been the victims of increasingly sophisticated cyber-attacks as they look to build protective capabilities while negotiating increasingly vigilant incident-disclosure norms.

The Law Society of England and Wales reported in December that 65 percent of law firms in the country had been hit by cyberattacks. Despite this, 35 percent of law firms do not have a cyber mitigation plan, the report said.  

In Singapore, the Law Society itself was ordered to plug security gaps last year after a ransomware attack compromised the information of 16,009 members, the Straits Times reported.

In a written judgment, Singapore’s privacy watchdog, the Personal Data Protection Commission,  said the Law Society had “negligently breached” its obligation to protect personal information by “using an easily guessable password” for its IT administrator account, which was hacked due to another vulnerability.

Singapore has stringent reporting requirements when it comes to cyber incident reporting. The Personal Data Protection Act requires organisations to notify the PDPC and affected persons as soon as possible if there is a data breach that is likely to significantly harm or impact the individuals concerned.

Fines for non-compliance can go up to S$1 million ($749,000) or 10 percent of the organisation’s annual turnover in Singapore, whichever is higher.

 

TO CONTACT EDITORIAL TEAM, PLEASE EMAIL ALBEDITOR@THOMSONREUTERS.COM

Related Articles

Milbank becomes 2nd U.S. law firm to shutter mainland office in a week

U.S. law firm Milbank has confirmed to ALB that it will close its Beijing office, which has been operating for 18 years. This makes it the second top-tier U.S. law firm, after Paul, Weiss, to announce its intention to call time on its mainland operations this week.

SUBMISSIONS OPEN: ALB Firms to Watch (Singapore) 2025

Submissions open for ALB Firm to Watch (Singapore) list. The list will highlight the law firms with a more compact partner structure or focused practice in the country. The list will be published in the January/February 2025 issue of ALB Asia. 

Paul, Weiss, which once led U.S. firms’ China charge, becomes latest domino to fall

New York-based law firm Paul, Weiss, Rifkind, Wharton & Garrison has confirmed to ALB that it will close its Beijing office by the end of 2024. According to records kept by ALB, it will become the 13th U.S. law firm this year to scale back its China operations.